~ / search / GHSA-jm6m-4632-36hf

GHSA-jm6m-4632-36hf

Composer Remote Code Execution vulnerability via web-accessible composer.phar

Source: GitHub Advisory Database (reviewed) High CVE-2023-43655

Packages

EcosystemPackageAffectedFixed in
Packagist composer/composer < 1.10.27 1.10.27
Packagist composer/composer >= 2.0.0, < 2.2.22 2.2.22
Packagist composer/composer >= 2.3.0, < 2.6.4 2.6.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has `register_argc_argv` enabled in php.ini. ### Patches 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. ### Workarounds Make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.

References

External links from the advisory. They lead to third-party sites.